Plugin Vulnerable to PHP Object Injection Affecting Authenticated Attackers

CVE-2024-8016

What is CVE-2024-8016?

The Events Calendar Pro plugin for WordPress is vulnerable due to a flaw in its handling of the ‘filters’ parameter in widgets, which allows for PHP Object Injection through the deserialization of untrusted input. Authenticated users with administrator-level access can exploit this vulnerability to inject malicious PHP objects, potentially leading to remote code execution. In certain configurations, users with lower privileges (such as contributor-level access) can also exploit this vulnerability, especially when the plugin is used alongside Elementor. It is critical for users to update to the latest version to mitigate this risk and ensure the security of their WordPress site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References